* ci(audit): retry PR-association check to stop false positives on squash-merges
listPullRequestsAssociatedWithCommit is eventually-consistent after a squash
merge; the single immediate call intermittently flagged legit merges as
'direct push to main'. Now polls up to 5x/10s before opening an issue.
Agent-Session: cto audit-race-fix
* chore: bump plugin header to 0.5.0 to match PR_CORE_VERSION constant
